CornFlake RAT svchost32 service creation masquerading as Cloud Sync Service
Detects the creation of a Windows service named 'svchost32' with a display name of 'Cloud Sync Service' via administrative command-line utilities like sc.exe, PowerShell, or cmd.exe. This activity is a known persistence mechanism for the CornFlake RAT, which masquerades as a legitimate system process to evade detection.
Microsoft Sentinel (KQL)
